[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f8KYysSiX7ocrnzs4ORm86wdi3UpB05ljwd5fpAAUQEY":3,"$fElovgypxGagie2I5UFd0dTfzLnKkMgVkufNd3WrFSNo":51},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":16,"hero_image_url":17,"structured":18,"story_type":47,"created_at":48,"updated_at":49,"published_at":50},"cisco-asa-and-ftd-vpn-dos-flaw-actively-exploited-in-the-wild","Cisco ASA and FTD VPN DoS Flaw Actively Exploited in the Wild","Unauthenticated remote attacker can force a device reload via crafted HTTP request to the Remote Access SSL VPN service, scoring CVSS 8.6.","Cisco PSIRT confirmed active exploitation of CVE-2026-20349 in August 2026, a High-severity DoS in the Remote Access SSL VPN service of Secure Firewall ASA and FTD software that lets an unauthenticated remote attacker trigger an unexpected device reload.",[10,11,12,13,14,15],"cisco","asa","ftd","ssl-vpn","dos","cve-2026-20349","# Cisco ASA and FTD VPN DoS Flaw Actively Exploited in the Wild\n\n*Unauthenticated remote attacker can force a device reload via crafted HTTP request to the Remote Access SSL VPN service, scoring CVSS 8.6.*\n\n**Tags:** `cisco` `asa` `ftd` `ssl-vpn` `dos` `cve-2026-20349`\n\n> Cisco PSIRT confirmed active exploitation of CVE-2026-20349 in August 2026, a High-severity DoS in the Remote Access SSL VPN service of Secure Firewall ASA and FTD software that lets an unauthenticated remote attacker trigger an unexpected device reload.\n\n---\n\n## Vulnerability details\n\n| CVE | CVSS | EPSS | KEV | PoC | PRS risk |\n|---|---|---|---|---|---|\n| CVE-2026-20349 | 8.6 | 2.2% | ✅ listed | — | 74.61 (High) |\n\n## Cisco ASA\u002FFTD VPN DoS Actively Exploited\n\nCVE-2026-20349 is a High-severity denial-of-service vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software. The flaw, rated CVSS 8.6, allows an unauthenticated remote attacker to send a crafted HTTP request that forces the device to reload unexpectedly, taking the VPN service offline.\n\nCisco PSIRT confirmed active exploitation in the wild in August 2026, with no public attribution to a specific threat actor, campaign, or target sector. CISA added the CVE to its Known Exploited Vulnerabilities catalog with a remediation deadline of August 14, 2026 for U.S. federal civilian agencies, underscing the urgency for perimeter-facing deployments.\n\n## How the Flaw Works\n\nThe root cause is insufficient error checking while the SSL VPN service processes incoming HTTP requests, which Cisco maps to CWE-244. An attacker sends a crafted HTTP request directly to the exposed SSL listen socket on the firewall. No credentials, admin interaction, or prior session are required.\n\nA successful request triggers an unexpected reload of the device, resulting in a full denial-of-service on the affected ASA or FTD instance. The CVSS vector confirms the attack profile: remote network vector, low complexity, no privileges required, and availability impact.\n\n## Which ASA\u002FFTD Configs Are Affected\n\nA device is affected when it runs a vulnerable ASA or FTD release with at least one SSL listen socket configuration enabled. The primary config is IKEv2 Remote Access VPN with client services, enabled via `crypto ikev2 enable \u003Cinterface>` on the relevant interface. Other SSL listen socket configurations listed in Cisco’s advisory are also in scope, but the IKEv2 client-services variant is the one most perimeter-facing deployments run.\n\nCisco ships hot fixes across six release trains: 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0. Administrators must match the exact platform and release train to Cisco’s fixed software guidance before upgrading, since the hot fix package is specific to the FTD release and appliance model. There is no full workaround — the vendor states none exists that fully addresses the flaw, so affected devices must either install the hot fix or move to a fixed release.\n\n## Active Exploitation and Detection\n\nCisco PSIRT confirmed in-the-wild exploitation of CVE-2026-20349 in August 2026, with no public proof-of-concept released at disclosure. The vendor did not publish a standalone PoC script or exploit binary alongside the advisory, meaning defenders must rely on the observed traffic pattern or the provided Snort rules to confirm the attack on their own devices.\n\nFor detection, Cisco shipped two Snort rules: 46897 and 59654. These rules match the crafted HTTP request against the SSL listen socket and can flag the reload trigger in real time. They are not a patch replacement, though — Cisco explicitly states no workaround fully addresses the flaw, so the rules should be deployed alongside the hot fix or fixed release, not in place of it.\n\nNo vendor-published IOCs (file hashes, IP addresses, or domains) were released tied to the observed exploitation. This means defenders cannot match the activity against a known set of artifacts and should lean on behavioral monitoring, device-health telemetry, and HTTP request inspection to confirm the reload. The absence of IOCs also means the activity is not yet tied to a specific campaign or C2 infrastructure.\n\nAttribution remains public-unconfirmed. Cisco did not name a threat actor, campaign, target sector, or geography. The activity could be cybercrime, espionage, hacktivism, or opportunistic scanning — the available reporting does not distinguish between them. Valerio Brussani independently identified and reported the same issue, but Cisco has not disclosed when either discovery originally occurred.\n\n## Key points\n\n- CVE-2026-20349 is a High-severity DoS (CVSS 8.6) in the Remote Access SSL VPN service of Cisco Secure Firewall ASA and FTD software.\n- An unauthenticated remote attacker sends a crafted HTTP request to the SSL VPN service to force an unexpected device reload, causing a denial-of-service.\n- Cisco PSIRT confirmed active exploitation in August 2026; CISA added it to KEV with a remediation deadline of August 14, 2026.\n- Affected configurations require IKEv2 Remote Access VPN with client services or a matching SSL listen socket; hot fixes span the 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0 release trains.\n- No public PoC or vendor-published IOCs are available; Cisco lists Snort rules 46897 and 59654 for detection.\n\n## Further reading & sources\n\n- [Cisco ASA and FTD CVE-2026-20349 Exploited](https:\u002F\u002Fsocradar.io\u002Fblog\u002Fcisco-asa-ftd-cve-2026-20349)\n- [CVE-2026-20349: Cisco ASA and FTD VPN DoS Flaw](https:\u002F\u002Fsocprime.com\u002Fblog\u002Fcve-2026-20349-actively-exploited-cisco-asa-and-ftd-flaw-enables-remote-dos)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fcisco-asa-and-ftd-vpn-dos-flaw-actively-exploited-in-the-wild.png?v=d65d86c076",{"cves":19,"timeline":30,"technologies":39},[20],{"id":21,"kev":22,"poc":23,"url":24,"cvss":25,"epss":26,"risk_band":27,"risk_score":28,"cvss_version":29},"CVE-2026-20349",true,false,"\u002Fvulnerabilities\u002FCVE-2026-20349",8.6,0.0101,"High",74.54,"3.1",[31,35],{"date":32,"event":33,"description":34},"2026-08","Active exploitation","Cisco PSIRT says it became aware of active exploitation of CVE-2026-20349 in August 2026.",{"date":36,"event":37,"description":38},"2026-08-11","Advisory published","Cisco published its security advisory on August 11, 2026",[40,43,45],{"vendor":41,"product":42},"Cisco","Secure Firewall Adaptive Security Appliance (ASA)",{"vendor":41,"product":44},"Secure Firewall Threat Defense (FTD)",{"vendor":41,"product":46},"Secure Firewall ASA","vulnerability_disclosure","2026-08-27T07:05:36.52841+00:00","2026-10-16T12:29:17.659703+00:00",null,{"articles":52},[53,66,79,91],{"slug":54,"title":55,"summary":56,"tags":57,"hero_image_url":64,"story_type":47,"created_at":65},"red-hat-keycloak-critical-flaw-lets-unauthenticated-attackers-reset-any-account-","Red Hat Keycloak Critical Flaw Lets Unauthenticated Attackers Reset Any Account Password","Red Hat disclosed a critical vulnerability in Keycloak's reset-credentials flow that allows a remote unauthenticated attacker to bypass the email verification step and reset the password for any user account in any realm.",[58,59,60,61,62,63],"Keycloak","Red Hat","CVE-2026-18963","CVSS 9.1","account takeover","password reset","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fred-hat-keycloak-critical-flaw-lets-unauthenticated-attackers-reset-any-account-.png?v=94dc54a17a","2026-09-30T12:09:12.456253+00:00",{"slug":67,"title":68,"summary":69,"tags":70,"hero_image_url":77,"story_type":47,"created_at":78},"trend-micro-zdi-windows-shell-link-zero-day-exploited-by-11-state-backed-groups-","Trend Micro ZDI: Windows Shell Link zero-day exploited by 11 state-backed groups since 2017","Trend Micro's Zero-Day Initiative disclosed a new Windows Shell Link (.lnk) zero-day (ZDI-CAN-25373) exploited in the wild by 11 state-backed groups since 2017, which Microsoft declined to patch as 'not meeting the bar servicing'.",[71,72,73,74,75,76],"windows","shell-link","zero-day","ZDI","Trend Micro","state-sponsored","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Ftrend-micro-zdi-windows-shell-link-zero-day-exploited-by-11-state-backed-groups-.png?v=a2818b0e7b","2026-09-30T12:04:13.324344+00:00",{"slug":80,"title":81,"summary":82,"tags":83,"hero_image_url":89,"story_type":47,"created_at":90},"head-mare-exploits-three-zero-days-to-trojanize-trueconf-atlassian-rovo-and-prog","Head Mare Exploits Three Zero-Days to Trojanize TrueConf, Atlassian Rovo, and Progress LoadMaster","The Head Mare APT group is actively exploiting three zero-day vulnerabilities in Atlassian Rovo, Progress LoadMaster, and Metabase, with Progress LoadMaster CVE-2026-8037 now on CISA KEV after 792 observed exploitation attempts.",[84,73,85,86,87,88],"Head Mare","Atlassian Rovo","Progress LoadMaster","Metabase","CVE-2026-8037","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fhead-mare-exploits-three-zero-days-to-trojanize-trueconf-atlassian-rovo-and-prog.png?v=48acc20ab2","2026-09-22T12:04:22.141581+00:00",{"slug":92,"title":93,"summary":94,"tags":95,"hero_image_url":102,"story_type":47,"created_at":103},"fidelis-security-discloses-wp2shell-attack-chain-for-unauthenticated-wordpress-r","Fidelis Security Discloses wp2shell Attack Chain for Unauthenticated WordPress RCE","Fidelis Security has disclosed the wp2shell attack chain, a two-CVE exploit that lets unauthenticated attackers achieve remote code execution on WordPress Core via the REST API batch endpoint and a WP_Query SQL injection in the author__not_in parameter.",[96,97,98,99,100,101],"WordPress","wp2shell","CVE-2026-60137","CVE-2026-63030","REST API","SQL Injection","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Ffidelis-security-discloses-wp2shell-attack-chain-for-unauthenticated-wordpress-r.png?v=b1c1aa3d09","2026-09-22T07:08:43.775939+00:00"]